F5 F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Exam Practice Test

The log message “Intercept exhaustion” indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A. Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B. Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C. Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

According to the provided exhibit, the "SSL Profile (Client)" section in the Virtual Server configuration is empty. For a BIG-IP system to process HTTPS traffic, it must act as an SSL/TLS endpoint. This process, known as SSL Termination or SSL Offload, requires the assignment of a Client SSL Profile to the Virtual Server. Without this profile, the BIG-IP does not have the necessary certificate and private key information to perform the SSL handshake with the client's browser. Consequently, when a user attempts to connect via HTTPS, the TCP connection may establish, but the SSL handshake will fail because the BIG-IP will not know how to decrypt the incoming encrypted packets.

A Client SSL profile defines the ciphers, certificates, and keys that the BIG-IP uses to communicate securely with the client. In a standard HTTPS deployment, the BIG-IP decrypts the traffic and can then send it to the backend pool members either as plain text (header insertion/manipulation) or re-encrypt it using a Server SSL profile. While a Server SSL profile (Option C) is needed if the backend servers themselves require HTTPS, the initial failure for a user reaching a Virtual Server is almost always the lack of a Client SSL profile to terminate the user's connection. Changing the Service Port to HTTP (Option D) would be incorrect because the goal is to handle HTTPS traffic (typically port 443). Assigning the "clientssl" or a custom client-side profile from the "Available" list to the "Selected" list in the GUI is the mandatory step to make the Virtual Server operational for secure web traffic.

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A. Adding a OneConnect profileOneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B. Enabling SNAT automapSNAT affects source address translation, not pool member selection.

C. Enabling a fallback host in the HTTP profileA fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

To fulfill the requirement of "SSL Offload" limited to "TLSv1.2 only," the administrator must focus on the client-side of the connection. SSL Offload means the BIG-IP terminates the encrypted connection from the user, processes the traffic (often as plain text internally), and optionally sends it to the backend. The profile responsible for this termination and the initial negotiation with the client's browser is the Client SSL Profile.

A custom Client SSL Profile must be created because the default clientssl profile typically allows a broad range of protocols for compatibility (including TLS 1.0, 1.1, and 1.2). To restrict communication specifically to TLS 1.2, the administrator modifies the Ciphers string within the profile. Using a string such as DEFAULT:!SSLv3:!TLSv1:!TLSv1.1 or specifically defining TLSv1.2-only suites ensures that the BIG-IP will reject any handshake attempts from older, less secure protocols.

Server SSL Profiles (Options B and C) are used for the encryption between the BIG-IP and the backend nodes, which is not what is requested here. Simply selecting "no TLSv1" in an options list (Option D) is insufficient and often refers to older versions of the software; the modern and standard way to control protocol negotiation on a BIG-IP is through the precise application of Cipher Strings within the Client SSL profile. This ensures compliance with security standards like PCI-DSS while providing the offloading benefits to the backend infrastructure.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

To provide encrypted communication between users and a virtual server, the BIG-IP system acts as a transparent SSL/TLS proxy. The administrative configuration required for this is a Client SSL profile.

When multiple hostnames (FQDNs) are associated with a single IP address, the system must determine which SSL certificate to present to the client during the initial TLS handshake. This is achieved using an extension of the TLS protocol called Server Name Indication (SNI).

The configuration logic is as follows:

Profile Type: The Client SSL profile is responsible for terminating the SSL connection from the client (the user) to the BIG-IP system.

The Setting: Within the Client SSL profile (under the "Advanced" view), there is a field specifically called Server Name. By entering the specific hostname (e.g., in this field, the BIG-IP system can match the hostname requested by the client in the ClientHello message to the correct profile.

Implementation: The administrator typically creates multiple Client SSL profiles—one for each hostname—and assigns them all to the same virtual server. One of these profiles must be designated as the Default SSL Profile for SNI to handle requests where the client does not provide a hostname or provides one that does not match any specific profile.

By using the Client SSL profile and the Server Name setting, the BIG-IP system ensures that each user receives the correct certificate for the specific site they are trying to reach, even though all sites share a single virtual server IP.

SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.

According to the BIG-IP Administration: Data Plane Configuration documentation:

An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.

When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.

Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.

Why the other options are incorrect:

A. Set Protocol to UDPSSH uses TCP, not UDP. Changing the protocol would break SSH entirely.

B. Set Source Address to 10.1.1.2The source address setting controls client access restrictions and is unrelated to protocol parsing issues.

C. Set Destination Address/Mask to 0.0.0.0/0The destination address is already valid for a specific SSH service and does not impact protocol handling.

Correct Resolution:

The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.

In a default BIG-IP configuration, the system utilizes the Load Balancing Method (typically Round Robin) to distribute each new connection across available pool members. However, the introduction of a persistence profile fundamentally changes this behavior. Persistence (also known as "stickiness") ensures that once a client has been load balanced to a specific pool member, all subsequent requests from that same client during a defined session or timeout period are directed to that same member, bypassing the standard load balancing algorithm. This is critical for applications that maintain state, such as shopping carts or authenticated sessions, where moving a user to a different server would result in a loss of session data.

While other options affect traffic handling, they do not "alter" the fundamental load balancing decision in the same way. A OneConnect profile (Option A) optimizes connection management by pooling idle server-side connections; while it changes how connections are reused, the initial load balancing decision still follows the configured method. A fallback host (Option C) is only utilized when the primary pool is unavailable, and since the question states all pool members are online, it remains inactive. SNAT Automap (Option D) changes the source IP address of the packet as it exits the BIG-IP toward the server to ensure return traffic passes back through the ADC, but it does not dictate which server is chosen for the request. Therefore, the persistence profile is the primary configuration element that overrides the load balancing algorithm to maintain a client-to-server relationship.

The BIG-IP Configuration Utility (GUI) organizes information hierarchically to allow for granular management of application objects. A Pool is a collection of backend servers (pool members) that provide the same service. To verify the specific network parameters—such as the IP address and the service port—of the servers within a pool, the administrator must navigate to the specific pool's configuration.

The standard procedural path to verify this is Local Traffic > Pools: Pool List, where the administrator selects the specific pool name. Once inside the pool's configuration, the Members tab displays a list of all IP addresses and service ports associated with that pool. Under the "Service Port" column, the administrator can confirm if the member is listening on port 80 (HTTP).

Options A and B are incorrect for this specific verification task. While Nodes (Option A) show the health of a physical server, a node represents only an IP address and does not have a "Service Port" associated with it until it is defined as a pool member. Verifying the Health Monitor (Option B) would tell the administrator how the system is checking the member's status, but it does not definitively show the port on which the member is actually receiving application traffic. In a BIG-IP environment, a pool member is uniquely identified by the combination of its Node IP and its Service Port, and the Members tab is the primary interface for managing and auditing these specific member attributes.

F5 provides several pre-configured (built-in) TCP profiles designed to optimize traffic for different network conditions. When an administrator is looking to improve general performance but does not have a specific, narrow use case (like strictly mobile or strictly long-haul WAN), the f5-tcp-progressive profile is the recommended starting point.

The f5-tcp-progressive profile is designed as a modern, high-performance replacement for the older default TCP settings. It incorporates several advanced congestion control algorithms and buffer management techniques that allow it to adapt dynamically to varying network latencies and packet loss scenarios. Unlike f5-tcp-legacy (Option A), which uses older, less efficient stacks, the progressive profile leverages modern TMM (Traffic Management Microkernel) optimizations.

While f5-tcp-mobile (Option B) is highly effective for high-loss cellular networks and f5-tcp-wan (Option D) is optimized for high-latency long-distance links, they can sometimes be too aggressive or poorly suited for standard campus or data center environments. The f5-tcp-progressive profile acts as a "best-of-all-worlds" template that typically provides an immediate performance boost for most web applications by improving window scaling and fast-retransmit behavior. Therefore, it is the procedural "first step" in TCP performance tuning before moving to more specialized, niche profiles.

SNAT Automap is a common configuration that replaces the client's original source IP address with one of the BIG-IP's self IP addresses. This ensures that the backend servers send return traffic back through the BIG-IP, which is necessary for the ADC to process the traffic correctly. However, a side effect of SNAT is that the backend servers only see the BIG-IP's IP in their logs, losing visibility into the true identity of the client.

To resolve this while still using SNAT for routing purposes, the administrator must configure the BIG-IP to "pass" the client's IP address at the application layer. This is achieved by using an HTTP Profile with the Insert X-Forwarded-For setting enabled. When this profile is applied to the Virtual Server, the BIG-IP intercepts the HTTP request, adds a header (X-Forwarded-For) containing the client's original IP, and then forwards the modified request to the server. The backend web server can then be configured to read this header and log the original client IP instead of the BIG-IP's SNAT address.

Other options are incorrect for this requirement. Performance (HTTP) (Option A) is a virtual server type optimized for speed but often lacks the full Layer 7 header manipulation capabilities of a Standard Virtual Server. SNAT Pool with the client IP (Option C) is technically impossible as SNAT pools use static, pre-defined IPs. There is no such thing as an HTTP Transparent profile (Option D) in standard BIG-IP administration for this purpose. The X-Forwarded-For header insertion within the HTTP profile is the standard procedural method for maintaining client visibility in SNAT-enabled environments.

In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:

iRules are associated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under the Resources tab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.

SSH is a TCP-based service. A TCP monitor validates service availability without requiring application-layer inspection.

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions. When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.

C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.

In the F5 BIG-IP ecosystem, a standard ICMP health monitor functions by sending an ICMP echo request to a target node and expecting an ICMP echo reply within a specified timeout period. When a node is marked "DOWN" despite the backend server being configured to respond to ICMP, the issue typically lies in the network path or the specific packet exchange between the BIG-IP's self IP and the node's IP. Running a tcpdump is the most effective next step because it provides a real-time packet capture of the actual monitor traffic leaving the BIG-IP and any return traffic coming back from the server. This allows the administrator to verify if the BIG-IP is actually sending the echo request, if the request is reaching the server, and if the server is indeed replying or if the reply is being dropped by an intermediate firewall or a security policy.

While other tools have their place, they are inappropriate for this specific layer 3/4 connectivity issue. A qkview is a comprehensive diagnostic file used primarily for F5 Support to analyze the entire system's state but is overkill for initial connectivity troubleshooting. An ssldump is used for inspecting SSL/TLS handshakes and encrypted payloads, which is irrelevant for a non-encrypted ICMP monitor. A curl command is a tool for testing HTTP/HTTPS application-level responses; it cannot be used to troubleshoot ICMP (ping) connectivity directly. By using tcpdump -ni host , the administrator can see the ICMP "type 8" (request) and "type 0" (reply) packets, immediately identifying if the monitor failure is due to a "Destination Unreachable" message or a simple lack of response, thereby pinpointing the root cause in the data plane.

The BIG-IP system uses a centralized management framework to ensure that all devices within a Sync-Failover group share a consistent configuration. When an administrator makes a change on any member of the group—whether it is the active or the standby device—the system detects a "ConfigSync" mismatch. The "Device Management >> Overview" screen tracks these changes by comparing the commit ID and timestamps of the configurations across all peers.

If a change is made on the standby member, that device now possesses a more recent configuration than the other members of the group. Consequently, the BIG-IP GUI will display a status of "Changes Pending" and suggest a Recommended Action to resolve the discrepancy. In this scenario, the correct action is to Synchronize the standby member configuration to the group. This push operation will copy the updated configuration from the standby device to the active device (and any other peers), bringing the entire cluster back into a "In Sync" status. It is important to note that BIG-IP allows bi-directional synchronization; you do not have to be on the active device to push a configuration. However, administrators must be cautious: choosing Option C (Synchronizing the active member to the group) would overwrite the changes just made on the standby device with the older configuration from the active device, effectively reverting the changes. The Recommended Action always points toward the direction that propagates the most recent change to the rest of the group.

Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.

SSH is a TCP Layer 4 protocol. Applying an HTTP profile causes BIG-IP to expect HTTP headers, breaking SSH sessions. Removing the HTTP profile allows raw TCP forwarding.

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

The issue of "lost shopping carts" in an ecommerce environment is a classic symptom of a missing or improperly configured Persistence Profile. In modern web applications, session data—such as items added to a cart—is often stored locally on the specific web server that initially handled the user's request. If the BIG-IP system load balances a user's subsequent request (like clicking "Checkout") to a different server among the 50 webservers, the new server will not have the session data, and the user will appear to have an empty cart.

While Least Connections (node) is an efficient load balancing algorithm, it makes a new decision for every connection unless persistence is enabled. To resolve this, the administrator must implement a persistence mechanism. HTTP Cookie Persistence (Option A) is the industry standard for web applications. By assigning a cookie persistence profile to the Virtual Server, the BIG-IP inserts a unique cookie into the HTTP response. When the user's browser returns that cookie in future requests, the BIG-IP identifies the specific server that handled the first request and consistently directs the user back to that same server for the duration of their session.

Sip_info (Option B) is a persistence method for VOIP traffic and is not applicable to web traffic. Ratio load balancing (Options C and D) merely changes the distribution frequency but still does not guarantee that a specific user will stay on the same server across multiple requests. Therefore, adding a cookie persistence profile is the direct procedural fix to maintain session state and ensure ecommerce functionality.

The log message "aggressive mode activated" indicates that the BIG-IP's adaptive connection management system (the "Sweeper") has detected that the system's memory or connection limits are reaching a critical threshold. To protect the system from crashing due to memory exhaustion (OOM), the BIG-IP enters Aggressive Mode, where it begins to proactively and rapidly reap (close) idle connections to free up resources for new incoming traffic.

To mitigate this and return the system to a healthy state, the administrator needs to reduce the overall resource footprint of existing connections. Decreasing the TCP profile Idle Timeout value (Option B) is the most effective administrative action. In many environments, the default idle timeout is 300 seconds (5 minutes). If a large number of connections remain "open" in the BIG-IP connection table long after the clients have stopped sending data, they consume valuable TMM (Traffic Management Microkernel) memory. By lowering the timeout (e.g., to 60 or 120 seconds), the BIG-IP can expire and remove these inactive entries much sooner, preventing the connection table from bloating and triggering the Sweeper's aggressive mode.

Conversely, increasing the timeout (Option C) would exacerbate the problem by keeping "dead" connections in memory even longer. Connection Mirroring (Option D) actually increases memory usage because every connection must be duplicated on the standby peer. An active-active configuration (Option A) might spread the load but does not address the underlying resource management issue on the individual units. Therefore, tightening the idle timers is the standard procedural fix for memory pressure caused by high connection volumes.

Slow Ramp Time prevents new pool members from receiving a full share of traffic immediately, allowing applications to warm up gradually.